Privacy policy

Who is the data controller

The controller of personal data is Kevin Korenika s.p., trading as Aithena, Montinjančevo naselje 18, 6276 Pobegi, Slovenia, company registration number 9271830000, VAT ID SI68065221. For any question about personal data, write to info@aithena.co or call +386 70 743 718.

We have not appointed a data protection officer, because the conditions in Article 37 of the General Data Protection Regulation are not met in our case.

This policy applies to every visitor to this site, wherever you are. We are established in the European Union, so the GDPR is the standard we apply to everyone, including visitors and clients in the United States, rather than a lower standard for some.

What data is processed

Data you give us. Name, email address, company, country or time zone, and the content of your message when you use a form on this site, email us or call us. If you become a client, we also process the data needed to conclude a contract and issue an invoice.

Temporary technical states of the contact form. If a submission cannot be completed — for example because a field is missing, because it was resubmitted too quickly, or because delivery failed — we store your entries (name, email address, subject and message) temporarily so that you do not lose them when you return to the form. That record lasts at most five minutes and is deleted as soon as the page has shown it once. After a message has been sent successfully we also store, for 60 seconds, a short value computed from your email address with a one-way function and a secret key, which we use to limit repeated submissions; we do not store the address itself, and we do not store the message, the IP address or browser details. Both states are temporary and neither is a permanent record.

Data created automatically. IP address, browser type and version, operating system, time of access and the page visited. This is created in server logs and is necessary for the operation and security of the site.

We use web analytics only with your consent. We use Google Analytics 4 for visit statistics. It loads only after you allow the Analytics category in the cookie banner. Without your consent it does not load and no analytics data is created.

Purposes and legal bases

• Answering your inquiry and preparing a proposal. Legal basis: steps taken at your request before entering into a contract, Article 6(1)(b) GDPR.
• Delivering the agreed services. Legal basis: performance of a contract, Article 6(1)(b).
• Operation, security and prevention of abuse of the website. Legal basis: our legitimate interest, Article 6(1)(f).
• Measuring traffic and improving the website. With Google Analytics 4 we measure how many visitors come to the website, where they come from, which pages they view and whether they send an enquiry. We process pseudonymous data: a random identifier from a cookie, pages viewed, traffic source, device and browser type and approximate location (country, region, city). Google Analytics 4 does not store full IP addresses. The legal basis is your consent, point (a) of Article 6(1) GDPR, together with the provisions of the Slovenian Electronic Communications Act on storing information in the user’s terminal equipment. We keep the data in Google Analytics for 14 months. You can withdraw consent at any time in the cookie settings.
• Complying with legal obligations, for example retention of accounting records. Legal basis: Article 6(1)(c).

How long we keep data

• Inquiries that do not lead to an engagement: at most two years from the last contact, then deleted.
• Client data: for the duration of the engagement and for as long as statutory limitation periods for possible claims require.
• Accounting records: for the periods set by tax and accounting legislation.
• Server logs: at most twelve months.

Who receives the data

We do not sell personal data, and we do not share it for cross-context behavioral advertising. Access may be given to our processors who help us deliver the service: the web hosting provider, which hosts the website and our email, and our external accounting service. With each of them the relationship is governed by Article 28 of the General Data Protection Regulation.

We host the fonts ourselves, and the pages embed no maps, videos or social plugins. The only third-party service is Google Analytics 4, provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), which loads only with your consent. As a processor, Google may also process data in the United States; the transfer relies on the EU-U.S. Data Privacy Framework, under which Google LLC is certified.

We may also disclose data to competent authorities where the law requires it.

Cookies

On your first visit we ask for consent. The cookies that record your decision are written when you decide, and they do not require consent, because without them we could not honor your decision. The banner offers an Analytics category that turns on Google Analytics. If you do not allow it, no analytics loads. We use no advertising tools.

Your rights

In relation to your personal data you have the right of access, rectification, erasure, restriction of processing, data portability, and the right to object to processing based on legitimate interest. Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

To exercise a right, write to info@aithena.co. We reply without undue delay and at the latest within one month of receiving the request. If the request is complex, we will tell you about the extension.

If you are in the United States

We are a small European provider and we do not meet the thresholds that make the California Consumer Privacy Act apply to a business. We still state plainly what matters most under it: we do not sell your personal information and we do not share it for cross-context behavioral advertising. If you are in the United States and want your data accessed, corrected or deleted, write to info@aithena.co and we will handle it under the same process described above.

Commercial email: we only email people who have contacted us or engaged us. Every commercial message identifies the sender, includes our postal address and offers a way to opt out, which we act on promptly.

Right to complain

If you believe we process your data unlawfully, you may complain to a supervisory authority. Ours is the Information Commissioner of the Republic of Slovenia, Dunajska cesta 22, 1000 Ljubljana, gp.ip@ip-rs.si, www.ip-rs.si. If you are in another EU or EEA country, you may also complain to the authority where you live or work.

Automated decision-making

We do not carry out automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you.

Security

We use appropriate technical and organizational measures to protect data, including an encrypted HTTPS connection, controlled access to systems and regular backups. No transmission over the internet is completely secure, so absolute security cannot be guaranteed.

Providing data is not mandatory

You do not have to provide personal data to browse this site or to ask a question; without the data in the form we simply cannot reply. When a contract is concluded, the data needed for the contract and the invoice is a contractual and statutory requirement, and without it the contract cannot be concluded.

Changes to this policy

We may update this policy when our services or the applicable rules change. The version published on this page is always the one that applies. This English text mirrors the Slovenian privacy policy; where the two differ in meaning, the Slovenian version prevails.